CVE-2026-72788

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the UILayout filter that fails to properly restrict administrator workspace state from publish readers. Unauthenticated attackers can retrieve the administrator's open documents, search terms, notebook paths, and...

CVE-2026-72788 SiYuan before v3.7.4 Information Disclosure via UILayout Filter

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the UILayout filter that fails to properly restrict administrator workspace state from publish readers. Unauthenticated attackers can retrieve the administrator's open documents, search terms, notebook paths, and...

PT-2026-71230

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description An information disclosure issue exists in the UILayout filter that fails to properly restrict the administrator's workspace state from publish readers. Unauthenticated attackers can retrieve sensitive...

PT-2026-71242

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description Authenticated readers or anonymous users when publish authentication is disabled can exploit missing publish-access filtering across multiple endpoints. The endpoint '/api/av/getAttributeViewKeysByID'...

PT-2026-85359

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-vpjw-wf5h-cgpq. This link is maintained to preserve external references. Original Description SiYuan versions before v3.7.4 fail to validate publish-password tier in getGraph and getLocalGraph endpoints, allowin...

CVE-2026-72796: Missing Authorization

SiYuan before v3.7.4 contains an access control bypass vulnerability where static-file routes in the server mux bypass publish-access controls enforced on the REST API. Attackers with publish reader tokens or anonymous access in disabled-auth mode can read templates, snippets, and export artifact...

CVE-2026-72801: Insufficiently Protected Credentials

SiYuan versions before v3.7.4 disclose encrypted-notebook key-derivation material and wrapped data keys through unauthenticated endpoints in publish mode. Attackers can retrieve Argon2id salt, cost parameters, password verifiers, and wrapped notebook keys to perform unlimited offline...

CVE-2026-72789: Missing Authorization

SiYuan before v3.7.4 fails to properly validate publish access for encrypted notebooks, treating them as publicly accessible by default. Anonymous readers can enumerate and retrieve fully decrypted document content from unlocked encrypted notebooks through the publish API without authentication o...

PT-2026-85349

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-qvq9-hq6p-v378. This link is maintained to preserve external references. Original Description SiYuan versions before v3.7.4 fail to enforce publish-access checks in the getBlockAttrs and batchGetBlockAttrs...

PT-2026-85350

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-8x84-r2ff-h8pq. This link is maintained to preserve external references. Original Description SiYuan versions before v3.7.4 disclose encrypted-notebook key-derivation material and wrapped data keys through...

PT-2026-71241

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description In publish mode, when the Publish.Auth.Enable variable is set to false, the software fails to enforce publish-access filters on five filetree path-resolution endpoints: 'getFullHPathByID',...

PT-2026-71231

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description Insufficient validation of publish access for encrypted notebooks allows them to be treated as publicly accessible by default. Anonymous readers can enumerate and retrieve fully decrypted document...

PT-2026-71237

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description An issue exists where the software fails to filter embedded block content based on publish access permissions. While the initial requested block is checked for authorization, blocks pulled in via embe...

PT-2026-71238

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description An access control bypass exists in the server mux where several static-file routes bypass the publish-access controls enforced on the REST API. This allows attackers with publish reader tokens or...

PT-2026-71239

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description An information disclosure issue exists in the 'getEncryptedNotebookStatus' endpoint. The system fails to apply publish-access filtering, allowing anonymous readers and accounts in publish-mode to...

PT-2026-71243

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description In publish mode, unauthenticated endpoints disclose encrypted-notebook key-derivation material and wrapped data keys. This allows attackers to retrieve the Argon2id salt, cost parameters, password...

PT-2026-71245

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description Insufficient publish-access checks in the 'getBlockAttrs' and 'batchGetBlockAttrs' endpoints allow attackers to retrieve block attributes from protected documents. By sending POST requests containing...

PT-2026-71247

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description Insufficient publish-access checks on the 'getBlockBreadcrumb', 'getRefText', and 'getBlockTreeInfos' endpoints allow the disclosure of protected document content and metadata. Anonymous readers or...

PT-2026-71250

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description An information disclosure issue exists in the '/api/asset/getFileAnnotation' endpoint. The endpoint returns .sya PDF-annotation file content without performing a publish-access check, as it is only...

CVE-2026-68340

In the Linux kernel, the following vulnerability has been resolved: hwmon: occ: validate poll response sensor blocks The OCC poll response parser walks a counted list of sensor data blocks. It used the static backing-array capacity as the parse boundary, but a transport response makes only...